Ajuda SQL

public string validaLogin(string login, string senha)
        {
            SqlConnection conexao = new SqlConnection("Data Source=.\\SQLSERVER;AttachDbFilename=\"C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLSERVER\\MSSQL\\DATA\\ProjetoGerenciador.mdf\";Integrated Security=True;Connect Timeout=30;User Instance=True");
            SqlCommand sql = new SqlCommand("Select nome from Usuario where login = \´" + login + "\´ and senha = \´" + senha + "\´;", conexao);
            SqlDataReader dr = null;
            try
            {
                conexao.Open();
                dr = sql.ExecuteReader();
                if (dr.HasRows)
                {
                    return dr.GetString(3);
                }
                else
                {
                    return "";
                }
            }
            catch (Exception e)
            {
                return "";
            }
            finally
            {
                conexao.Close();
                dr.Close();
            }
        }